Wireless security module

ABSTRACT

A wireless security module ( 20 ) adapted to authenticate a mobile device ( 16 ), such as a mobile telephone, thereby to allow communication between the mobile device and a terminal ( 12 ), such as a self-service terminal. The wireless security module ( 20 ) is paired with the mobile device ( 16 ) and is adapted to send an authentication signal to the mobile device ( 16 ) or the terminal ( 12 ) using a wireless communication path, such as a telecommunications network or an IR link or a Bluetooth connection.

BACKGROUND OF THE INVENTION

The present invention relates to a wireless security module. Inparticular, the present invention relates to a wireless security modulefor authenticating communications between a mobile device, such as amobile telephone, and a self-service terminal, such as an automatedteller machine.

With the ever-increasing popularity of mobile telephones and other suchwireless devices, there is a drive towards allowing consumers to accessmore and more different types of services via their mobile telephones.In particular, there are moves towards enabling a consumer to interactwith banking services using mobile devices. However, when a consumerwishes to carry out financial transactions from a mobile device, eithera telephone or PDA, numerous security issues arise. These are mainly todo with the authentication of the consumer and the consumer's device.

Security problems are particularly acute where the mobile device is tobe used to allow a consumer to remove cash from, say, an automatedteller machine. In this case, as well as verifying that the user is whohe claims to be, it is important to make sure that he is within closeproximity to the machine, so that when cash is dispensed, the user isthere to collect it. To overcome some of these security issues, it hasbeen proposed that the user's mobile telephone be adapted to includesecurity hardware and software for interacting with terminals. Adisadvantage of the need for additional hardware is, however, that itrequires modification to the user's mobile device. Clearly, this is asignificant limitation. There is therefore a need for a simple andsecure system for allowing communication between mobile devices such asmobile telephones and terminals such as self-service terminals.

SUMMARY OF THE INVENTION

According to one aspect of the invention, there is provided a system forauthenticating a mobile device, the system comprising: a wirelesssecurity module or device that is paired with the mobile device andadapted to send an authentication signal for authenticating the mobiledevice; and means for authenticating the mobile device using theauthentication signal received from the wireless security module.

The system may further comprise a wireless receiver for receiving theauthentication signal. The wireless receiver may be provided in aterminal. The terminal may be a self service terminal, such as anautomated teller machine. In the event that the mobile device isauthenticated, the terminal may be operable to provide a servicerequested from the mobile device. The terminal may be operable tocommunicate with the mobile device to provide the requested service. Theterminal may be part of a network of terminals. The terminal may beoperable to communicate with a control center. The terminal may beadapted to send the authentication signal to the control center, andreceive from the control center a return signal indicative of whetherthe mobile device is authenticated.

The authentication signal may include a unique identifier associatedwith the security module.

The authentication signal may include details of the mobile device, suchas a telephone number or an electronic address.

The security module may include an encryptor for encrypting theauthentication signal. In this case, the system further comprises meansfor decrypting the authentication signal.

All or at least part of the wireless security module is tamper proof.

According to another aspect of the invention, there is provided a methodfor authenticating a mobile device, such as a mobile telephone, themethod comprising: sending an authentication signal from a wirelesssecurity module that is separate from the mobile device, but pairedthereto; receiving the authentication signal and using theauthentication signal to authenticate the mobile device.

According to yet another aspect of the invention, there is provided awireless security module or device adapted to authenticate a mobiledevice, such as a mobile telephone, the wireless security module beingpaired with a mobile device and adapted to send an authentication signalto a means for authenticating the mobile using a wireless communicationpath, such as a telecommunications network.

The authentication signal preferably includes a unique identifier foridentifying the module uniquely.

The module or device may include a proximity tag for identifying theproximity of the device relative to a terminal. The proximity tag may bean RFID tag.

The module or device may include a secure memory for storing one or moreidentifiers for identifying the user's mobile device.

The wireless security module or device may include an encryptor forencrypting messages for sending to the mobile device or terminal.

The wireless security module or device may be adapted to communicatewith the mobile device.

The wireless security module or device may comprise a smart card orsecure hard drive that can be accessed wirelessly.

The wireless security module or device may be adapted to send theauthentication signal to a terminal, for example a self service terminalsuch as an automated teller machine.

According to yet another aspect of the invention there is provided aself service terminal, such as an automated teller machine (ATM), thatis adapted to receive from a wireless security module an authenticationsignal for authenticating a mobile device; use that signal to determinewhether the mobile device is authorized to access services and in theevent that the mobile device is authenticated, provide informationand/or services requested from the mobile device.

The self service terminal may be adapted to communicate with the mobiledevice.

The self service terminal may be adapted to communicate with a remotelylocated control center in order to determine whether the mobile deviceis authorized. The terminal may be adapted to receive details of theservice requested by the mobile device from the control center.

According to a still further aspect of the invention, there is provideda self service terminal, such as an ATM, that comprises means forreceiving from a wireless security module an authentication signal forauthenticating a mobile device; means for determining whether the mobiledevice is authorized to access services based on the authenticationsignal received and means for providing information and/or servicesrequested from the mobile device, in the event that the mobile device isauthenticated.

According to a yet still further aspect of the invention, there isprovided a mobile device, such as a mobile telephone, adapted for usewith the system, security module, method or terminal of any of thepreceding claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Various aspects of the present invention will now be described by way ofexample only, with reference to the accompanying drawings, of which:

FIG. 1 is schematic diagram of an ATM network;

FIG. 2 is a schematic diagram of an authentication system for allowingan ATM to interact with a mobile telephone;

FIG. 3 is a block diagram of an ATM for use in the system of FIG. 2;

FIG. 4 is a block diagram of a security module for use in the system ofFIG. 2, and

FIG. 5 is a flow diagram of a method for authenticating the mobiledevice of FIG. 2, thereby to allow services to be provided using theATM.

DETAILED DESCRIPTION

FIG. 1 shows an ATM network 10, in which each of the ATMs 12 isconnected to and able to communicate with a control center 14. Theconnection between the ATMs 12 and the control center 14 can be via anysuitable network such as a dedicated intranet or the internet.Alternatively, the ATMs 12 and the control center 14 may be adapted tocommunicate via a wireless communications network, such as atelecommunications network.

The control center 14 is operable to control, monitor and/or provideservices that are accessible via the ATMs. In accordance with practicein typical ATM networks, the control center 14 stores details of allauthorized users of the network, such as their names and addresses andpersonal identification numbers (PINs). These can be stored locally orglobally. It should be noted that whilst the control center 14 is shownschematically in FIG. 1 as being a single unit, it could comprise adistributed grouping of processors or servers.

In addition to communicating with the ATMs 12, the control center 14 isadapted to communicate with mobile devices 16 that are associated withauthorized users of the services provided by the control center and theATMs. The mobile devices 16 may be, for example, mobile telephones orPDAs. Communication between the mobile telephones 16 and the controlcenter 14 may be carried out using a wireless telecommunicationsnetwork, such as a cell phone network, or any other suitable wirelessnetwork.

In order to identify mobile devices 16 belonging to particular users,the telephone number or electronic address of these are stored at thecontrol center 14 together with the user's name, address and personalidentification (PIN) number. In this way, when a user accesses controlcenter services using their mobile device 16, a preliminary check can bedone to identify the user, merely by comparing the telephone number orelectronic address of the incoming communication. It will beappreciated, however, that whilst providing a check of this type may beadequate for some services, this level of identification alone does notprovide sufficient security for most financial transactions and wouldpose a risk were the user's mobile telephone to be stolen.

FIG. 2 shows a system 18 for allowing secure communication between amobile telephone 16 and a designated one of the ATMs 12 in the networkof FIG. 1. In this system 18, the ATM 12 is operable to communicate viaa wireless network with the mobile telephone 16 and additionally awireless security module 20. Each wireless security module 20 isassociated with one or more authorized mobile devices 16 and provides ameans for authenticating these devices, thereby to allow communicationbetween the devices 16 and the ATM 12.

FIG. 3 shows the automated teller machine 12 of FIG. 2 in more detail.This has a housing 22 with a front fascia 24 that has a screen 26 forpresenting financial information to a customer; a keyboard 28 forreceiving user inputs; a card slot 30 for receiving a customer's card; aprint-out slot 32 through which printed material is dispensed and a slot34 for dispensing cash through. Included in the ATM housing 22 is acontrol module 36 that is operable to control access to the bankingnetwork and any financial transactions. The control module includes aprocessor 37 that is connected to each of a card reader mechanism 38that is aligned with the card slot 30, a printer 40 that is aligned withthe print out slot 32 and a dispensing mechanism 42 that is aligned withthe dispensing slot 34. The card reader mechanism 38 is operable toreceive and read cards that are inserted into the slot 30. Informationread from the card by the card reader 38 can be transmitted to thecontrol module 36 for further processing. The printer 40 is operable toprint out financial information, such as bank statements, under thecontrol of the control module 36. The dispensing mechanism 42 isoperable to dispense cash that is stored in a secure enclosure, againunder the control of the control module 36.

All of the previously described features of FIG. 3 are commonplace inATMs and so will not be described in detail. In order to participate inthe authentication procedure for authenticating mobile devices, includedin the ATM 12 are the following additional components: a communicationsmodule 44 for receiving signals from and transmitting signals to each ofthe mobile device 16 and the secure module 20 using a wireless path; acontrol application 46 for allowing users to access services usingmobile devices 16; a secure memory 47, and a mechanism 48 for generatingsome form of reader field, which can detect the presence of a securitymodule 20 within its vicinity. Each of these additional components isconnected to and/or able to communicate with the processor 37 in thecore module 36. The communications module 44 may include, for example,an IR port or any other suitable wireless communication transceiver forsupporting wireless communications such as Bluetooth. Of course, inorder to maximize the number of devices that the ATM 12 can communicatewith, the communications module 44 may include each of an IR port and aBluetooth port. The control application 46 includes an encryption modulefor encrypting signals for sending to the security module 20 and adecryption module for decrypting signals received from the securitymodule 20.

Using wireless technology, the security module 20 of FIG. 2 is adaptedto provide both authentication and location information, therebyallowing the ATM 12 to provide secure services, such as dispensing cash.Each mobile device 16 is associated with a particular one of thesecurity modules 20, the mobile device 16 and security module 20 pairbeing associated in turn with a pre-determined user of the system. Inorder to authenticate a mobile device 16, the security module 20 firstlyhas to be paired with that mobile device.

FIG. 4 shows the security module 20. From this it can be seen that itincludes a processor 50 that can communicate with a secure memory module52. Stored in the memory module 52 are an authentication application forimplementing an authentication procedure; details of the user's mobiletelephone, such as the telephone number, and a unique identifierassociated with the security module 20, as well as other authenticationinformation. The unique identifier is written into the secure memory 52during manufacture of the security module 20 and is additionally storedin the control center 14, together with the other user details, such asname, address, PIN and mobile telephone number.

As well as the secure memory 52, the security module 20 includes thefollowing features: a communication module 56 that is operable totransmit signals to and receive signals from each of the mobile device16 and the ATM 12—this may be an IR based unit or Bluetooth, dependingon the communication mechanism used by the mobile device 16 and the ATM12; an unsecured memory 58 for running a financial application; aproximity tag 60, such as RFID, for providing proximity information forthe fulfillment of various transactions by the consumer, and anencryption module 62.

Included in the encryption module 62 is an algorithm for encryptingmessages for sending between the security module 20 and the ATM 12. Anysuitable encryption method could be employed. As an example, however,asymmetric encryption is used. This means that the key for encryptingthe message and the key for decrypting the message are different. In oneasymmetric encryption scheme, the ATM 12 has a private key and access,via the central control center 14, to a public key associated with thesecurity module 20. Included in the secure memory 52 of the securitymodule 20 for use by the encryption module 62 is a unique private key.Also stored in the secure memory 52 is a public key associated with theATM 12 or the overall network. This public key can be securely writteninto the security module 20 during initialization. Messages sent fromthe secure module 20 to the ATM 12 are encrypted using the ATM's publickey stored in the memory 52 and decrypted at the ATM 12 using itsprivate key. Likewise, messages sent from the ATM 12 to the securitymodule 20 are encrypted at the ATM 12 using the module's public key andthen decrypted in the module 20 using its private key, which is storedin the secure memory 52. In this way, the security module 20 and the ATM12 can mutually authenticate each other. This stops the security module20 from connecting to a fake ATM 12, which has a copy of the module'spublic key.

As another option, the encryption may use a public key infrastructure(PKI). In this case, the security module 20 has the bank's public keyand the ATM 12 has a public key that is associated with all authorizedsecure modules provided for use in the network. When an ATM 12 wishes tocommunicate with the secure module 20, it sends a certificate, such as aX.509 certificate containing the individual ATM's public key, which hasbeen signed using the bank's public key. The security module 20 verifiesthe signature using the bank's public key, which is stored in its securememory 51. If the verification is positive, this provides the module 20with the public key for the ATM. Otherwise, the communication isterminated. Likewise, when the module 20 wishes to communicate with theATM 12, it sends a certificate, such as the X.509 certificate, thatcontains its own public key, signed using a wireless service key. Itshould be noted that in this case the certificate would be loaded intoboth the ATM 12 and the secure module 20 pre-signed by the bank and sothese certificates are not created in either of the ATM or secure module20. This means that private keys do not have to be stored in either ofthe ATM 12 or the module 20.

Once the initial exchange is completed, authentication is carried outusing the ATM's public key and the module's public key. An advantage ofthis is that the mobile device does not have to know the public keys foreach ATM 12 in the network and the ATM 12 does not have to have accessto the public keys for every secure module 20. It also allows normal PKIfunctions to be carried out, such as key revocation and key updates. Thesecure module 20 includes some form of tamper resistance to protect itsintegrity, and in particular to prevent access to information stored inthe secure memory 52. The tamper resistance could for example involveencasing the secure memory in resin, the arrangement being such thatshould the memory be physically tampered with, it is automaticallyerased. This provides a mechanism for protecting the unique identifierassociated with the card, as well as the encryption key(s). Methods forproviding this type of tamper resistance are known and so will not bedescribed in detail.

As will be appreciated, employing tamper resistant features in thesecurity module 20 is possible, because once the module 20 is configuredby the financial institution it does not need to interact physicallywith any devices, since all communications are wireless. Including thislevel of security in, for example, a mobile telephone would requireextra hardware, and so physical adaptation of the handset, which wouldbe problematic. Transferring the security to a separate module 20provides a simple and cost effective solution.

The security module 20 may be a smart card or any other small devicewith processing capabilities. In a preferred embodiment, the securitymodule 20 is small enough to be carried or fitted into a standardwallet.

Details of the user's mobile device or devices could be written into thesecure memory 52 when the secure module 20 is being manufactured, thesedetails being provided by the financial institution. Alternatively, theuser's mobile telephone number or other electronic address could bedownloaded into the secure memory 52 as part of an initializationcarried out when the user first receives the module.

The security module 20 may be given to the user in the premises of thefinancial institution, for example the user's bank. Pairing with theuser's mobile 16 could be done in a private and secure area of thefinancial institution, suitably screened to prevent other wirelessdevices from detecting the secure module 20. The pairing could beinitiated using a secure mediator device (not shown) provided by thebank, which is adapted to initialize both devices 16 and 20. At thisstage, the details of the user's mobile 15 could be transferred ordownloaded directly to the control center 14 to be stored together withthe other customer information.

To prevent unauthorized mobile devices 16 from being paired with thesecure module 20, a one-time PIN could be required for the securitymodule 20 to accept the new connection. Ideally, there would also be aPIN for the mobile device 16. The security mediator is adapted so thatentry of each of these codes allows mutual authentication of the twodevices. As another option, the module 20 may be provided with aone-time access code, which is stored in its secure memory 52. Thefinancial institution knows this one-time code. When the securitymediator is carrying out the initialization it sends the one-time accesscode to the security module 20, together with details of the authorizedmobile 16. When this one-time code is received, the security module 20recognizes that this mobile device 16 has to be registered. After theauthorized device 16 is registered with the module 20, the access codeused is either erased from the memory 52 or is marked as having beenused already. In this way, even if the access code is illegallyintercepted and copied it cannot be used again to register anunauthorized mobile. Of course, a plurality of different access codescould be stored in the secure memory 52 of the module 20 so that otherauthorized devices can be registered. The other codes are also one-timesession codes, which after use by authorized mobiles are either erasedor flagged in the secure memory as having been used.

As will be appreciated, when the initial pairing is done in a securearea of the financial institution, any suitable security technique couldbe employed.

As noted before, the security module 20 is provided to authenticate themobile device 16 and thereby allow the mobile to interact with the ATM12. In order for the mobile device 16 to carry out this interaction, itneeds a wireless communications port, such as an IR port or Bluetoothport, which is able to communicate with the communications module 56 inthe wireless secure module 20 and the communications module 48 in theATM 12. These ports are commonplace on mobile devices currentlyavailable. Also needed is a dedicated software application. Thisapplication can be downloaded to the device 16 using any suitablemechanism. Typically, the application is provided as part of theinitialization process carried out at the financial institution. Itshould be noted however that to access services provided by the ATM 12,the user has to be carrying each of the mobile device 16 and thesecurity module 20.

The application stored on the mobile 16 may enable a number of differentservices, but as a specific example, the provision of money from an ATM12 will be considered. To allow this, the application is operable toestablish a connection with the control center 14. This can be done viathe cell phone network or using the wireless communications port toaccess a local wireless connection such as Bluetooth or a wireless localarea network (LAN) operating in a bank branch, which allows the customerto communicate with the bank's systems in the branch. By using aconnection mechanism such as Bluetooth or the LAN rather than thetelecommunications network, the cost of a mobile telephone call can beavoided. The application in the mobile telephone is also adapted topresent screens or interfaces to the user to guide them through variousstages, for example establishing what service the user wants to use.

Once an initial connection with the control center 14 is made, thecontrol center is able to identify the mobile device 16 that wants toaccess services. This means that the control center 14 can identify thesecure module 20 with which that mobile 16 is paired.

When the user decides to withdraw cash, the application in the mobiledevice 16 generates and sends a signal to the control center 14 tonotify it of this decision. Using positional information obtained fromthe telecommunications network provider, the control center 14 is ableto identify the location of the user and then identify the nearestusable ATM in the network. Once this is established, a signal indicativeof this is sent to the mobile device 16. Alternatively, the user mayselect a particular ATM using for example a list of ATMs provided by thecontrol center 14. Once this is done, a signal indicative of the chosenATM is sent to the control center 14. In either case, the user then hasto move into the proximity of the selected ATM 12.

Before dispensing cash from the ATM 12 an authentication procedure iscarried out. This depends on the proximity of the user to the ATM 12, aswell as verification of the details of the mobile device 16. When theuser is standing in front of the designated ATM 12, the secure module 20is used. At this stage, the proximity tag 60 in the secure module 20 isin the reader field that surrounds the ATM. This triggers a detectionmechanism in the tag 52, which causes a signal to be sent to theprocessor 50 in the module 20. The processor 50 recognizes this signalas indicating that the module 20, and so the user, is correctly locatedin front of, or at least close to, the selected ATM 12. The processor 50then runs the authentication application, which controls theauthentication process.

There are various ways for implementing the authentication process, eachof which involves sending an authentication signal from the wirelesssecurity module 20 to the ATM; using the authentication signal toauthenticate the mobile device 16, and in the event that the device 16is authenticated, providing the service requested at the terminal. Thesesteps are shown in FIG. 5.

In a first example, the authentication application in the secure module20 creates a signal for sending to the ATM 12. This includes anidentifier that identifies the module 20, and optionally the telephonenumber of the user's mobile device 16. This signal is then encryptedusing the encryption module 62 and sent to communications port 48 in theATM 12. The signal is received at the ATM port 48 and decrypted usingthe decryption module of the ATM application. The ATM 12 then knows theidentity of the secure module 20 and optionally the telephone number ofthe user's mobile. The ATM 12 communicates with the control center 14 tocheck that the module 20 is an authorized module. To do this, the ATMsends the secure module's unique identifier to the control center 14.The control center 14 searches its register or list of authorized usersto identify whether the secure module 20 associated with the secureidentifier received from the ATM 12 is on record as being paired withthe mobile device 16 that made the initial request for services. In theevent that the control center 14 confirms that the module 20 that sentthe authentication signal and the mobile 16 that made the request forservices are paired, a signal is sent to the ATM 12 to confirm that thetransaction can proceed. If necessary, this signal includes the user'smobile telephone number or some other identifier associated with thetelephone, for example a unique serial number of the telephone or SIMcard information or the address of the wireless communications modulebuilt into the telephone. The ATM 12 then sends a signal from itswireless telecommunications port 48 to the mobile device 16 confirmingthat the transaction can proceed. Once this signal is received andrecognized by the mobile device 16, the user is then able to communicatedirectly with the ATM 12 using the mobile 16 so that the transaction canbe concluded. In this case, conclusion of the transaction would bedispensing of the requested amount of money.

In an alternative arrangement, rather than having to interrogate thecontrol center 14 for details of the secure module, the ATM 12 may beprimed to listen for signals from the secure module 20. In this case,when authentication is needed, the control center 14 uses details of themobile device 16 that made the initial request for services to find theidentifier associated with the security module 20 that is paired withthat mobile 16, and optionally the user's mobile telephone number. If nosecurity module has been paired with that mobile device then theauthentication process is terminated and a signal is sent to the ATM 12to present a statement on its screen 26 to this effect. If, however, themobile device 16 has been paired with a security module 20 theidentifier for this module is found and sent to the designated ATM 12 inadvance of the ATM 12 receiving the authentication signal from theuser's secure module 20. As before, the user moves into the vicinity ofthe ATM 12, which triggers the proximity tag 60. This in turn causes theuser's security module 20 to send the initial encrypted authenticationsignal. The information in this initial signal, and in particular theunique identifier for the module 20, is then compared with the dataalready sent to the ATM 12. In the event that the identifiers match, thetransaction is allowed to proceed. In the event that the identifiers donot match, the transaction is terminated. Priming the ATM 12 with thesecurity module's identifier improves the speed of the transaction forthe user. This is because it avoids the need for the ATM 12 to makecontact with the control center 14 and thereby saves time.

As yet another option, rather than sending an authentication signal tothe ATM 12 directly, the authentication application in the secure module20 may be operable to send the authentication signal to the ATM 12 viathe mobile device 16. The mobile 16 could be provided with the addressof the individual ATM 12 wireless module. Alternatively, the mobile 16could be adapted to broadcast a signal to all ATMs in the local area. Inthis case, when each ATM receives the signal, it notifies the controlcenter 14, which selects which ATM is to provide a response and sends anappropriate command signal thereto. This causes the selected ATM 12 togenerate and send a response, which contains its address, to the mobile16, thereby allowing a connection to be created. Once this is done, theauthentication process can proceed.

After the mobile device 16 is authenticated using the secure module 20,communications may be carried out directly between the mobile 16 and theATM 12. This is because the trust relationship has been passed to themobile 16. By this it is meant that the ATM 12 trusts the secure module20 and through the pairing the secure module 20 trusts the mobile device16, therefore the ATM 12 should trust the mobile 16. In a very securesystem, it may be that all communications have to be encrypted. In thiscase, since the secure module 20 has the encryption key, allcommunications would have to pass through the secure module 20.

The authentication information provided from the secure device 20 couldbe in the form of one time session authentication that does not exposethe actual key held in the secure device. This would allow the mobiledevice 16 to provide authentication to the ATM 12 without passing secureinformation across the wireless interface. In this case, since theauthentication is only valid for the current transaction, it cannot beused again in a replay attack even if the information were to becaptured by a third party.

The arrangement in which the present invention is embodied provides asecure module 20, which is given to the consumer to allow them toauthenticate themselves, and thereby access services using their mobiledevice, without requiring specialist hardware to be installed on theirmobile device 16. Merely by pairing a secure module with the user'smobile device, there is provided a simple and effective securityarrangement for authenticating the mobile device. Details of thispairing can be stored in a remote control center and/or in a secure areaof the secure module 20. As described above, there are several ways inwhich the authentication process can be carried out. All that is neededis mechanism for associating the mobile device being used by a customerwith a given, identifiable security module that is carried by that samecustomer.

By providing the secure module, it is possible to implement a securemethod of distributing and storing private and public keys for the usersin a tamper resistant device that allows the financial institution tomaintain their branding of the device.

The secure module of the present invention can be used with a number ofmobile devices that the consumer has without requiring the consumer toinstall security into each mobile device. An advantage of this is thatthe same strong authentication can be used with all devices, therebyproviding a consistent interface and level of security for the consumerin different types of transactions.

Since communications between the mobile device and the secure module arewireless then the consumer does not have to present the secure device tothe ATM and so it can remain in their pocket or handbag. This means thatthe authentication process is essentially transparent to the user, whotakes no active part in the process, thereby making it very simple fromthe user's perspective.

A further advantage of the invention is that the secure module could beused to contain the branding of the financial institution that providedit, something that would be difficult if the secure device wereintegrated into the consumers mobile device as a SIM card etc.

A skilled person will appreciate that variations of the disclosedarrangements are possible without departing from the invention. Forexample, whilst the invention has been described in connection with anautomated teller machine, it could be applied to a number of otherscenarios such as point of sale terminals, or kiosk purchases coveringthe purchase of tickets, music etc. In addition, although in thespecific example described, the initial request for services iscommunicated via the control center, it will be appreciated thattransactions could be initiated at the ATM. This could be done if thecustomer entered the range of the wireless communications modules 44 and56, such as Bluetooth, built into the ATM 12 and secure module 20, aswell as that of the corresponding wireless communications module in themobile device 16. In this case, as well as sending an initial requestfor services, the mobile device 16 sends a signal telling the securemodule 20 to open up a secure communication channel using the keyexchange mentioned previously. If the module has not already created anylinks but wishes to make a connection then it could broadcast a signalto all devices in the area. The ATMs that receive the signal couldnotify the control center 14, which selects the ATM that should respondto the message and start the authentication. The selected ATM thenresponds, interacts with the secure module 20 as previously described toauthenticate the mobile 16 and provides the services requested, such asaccess to account and balance information. It should be noted that whencommunications are opened with the ATM 12, the customer is notnecessarily in the range of the RFID tag, but is in the range of thelarger wireless connection for the ATM 12, such as a Bluetoothconnection. Only once the cash is to be collected does the user moveclose enough to the ATM 12 to trigger the RFID tag. In this case, theATM 12 already has a secure link to the mobile 16 and secure unit 20 andso all it has to do is match up the pending cash dispensing transactionwith the device physically in front it and fulfil the transaction. Thismodel can also be used in a branch type scenario where instead ofconnecting to the control center 14, the customer actually connects toan ATM 12 and carries out their wireless interaction with it. In thiscase the actual request for cash could then be put onto the ATM networkand carried out at any ATM on the network when an ATM is triggered bythe RFID tag on the secure module 20.

Accordingly, the above description of a specific embodiment is made byway of example only and not for the purposes of limitation. It will beclear to the skilled person that minor modifications may be made withoutsignificant changes to the operation described.

1. A system for authenticating a mobile device, the system comprising: awireless security module separate from and having a preestablishedrelationship with the mobile device, the wireless security module havinga secure memory storing security information establishing thepreestablished relationship between the security module and the mobiledevice and including means for sending an authentication signal forauthenticating the mobile device; means for authenticating the mobiledevice based upon the authentication signal from the wireless securitymodule; and a wireless receiver for receiving the authentication signal,the means for authenticating the mobile device including means forestablishing a trust relationship between the security module and anexternal device to which the mobile device seeks to be granted access,the means for authenticating the mobile device further operating toverify the existence of the preestablished relationship between thesecurity module and the mobile device so that the trust relationshipestablished for the security module can be granted to the mobile device.2. A system as claimed in claim 1, wherein the wireless receiver isprovided in a terminal.
 3. A system as claimed in claim 2, wherein theterminal comprises a self service terminal.
 4. A system as claimed inclaim 3, wherein the terminal includes means for providing a servicerequested from the mobile device, in the event that the mobile device isauthenticated.
 5. A system as claimed in claim 4, wherein the terminalincludes means for communicating with the mobile device to provide therequested service.
 6. A system as claimed in claim 5, wherein theterminal is part of a network of terminals.
 7. A system as claimed inclaim 6, wherein any one of the terminals can be used to provide therequested service.
 8. A system as claimed in claim 2, wherein theterminal comprises an automated teller machine having a mechanismgenerating a reader field to sense the presence of the wireless securitymodule within a predetermined proximity of the automated teller machine.9. A system as claimed in claim 8, wherein the wireless security modulefurther comprises an RFID proximity tag for providing proximityinformation to be sensed by said mechanism.
 10. A system as claimed inclaim 1, wherein the mobile device is utilized to request the ATM todispense cash, but cash dispensing is inhibited until both mobiledevices have been authenticated and the wireless security module hasbeen sensed within the predetermined proximity of the automated tellermachine.
 11. A system as claimed in claim 1, wherein the authenticationsignal includes a unique identifier associated with the mobile device.12. A system as claimed in claim 1, wherein the wireless security moduleincludes an encryptor for encrypting the authentication signal.
 13. Asystem as claimed in claim 12, further comprising means for decryptingthe authentication signal.
 14. A system as claimed in claim 1, whereinall or at least part of the wireless security module is tamperresistant.
 15. A method of authenticating a mobile device, the methodcomprising: sending an authentication signal from a wireless securitymodule which is paired with the mobile device and which is separate fromthe mobile device, the security module including stored informationindicating an association between the security module and the mobiledevice, the authentication signal including information for establishinga trust relationship between the security module and an external devicewith which the mobile device is to be used, the authentication signalincluding information indicating the association between the securitymodule and the mobile device; receiving the authentication signal;establishing a trust relationship for the security module based on theauthentication signal; and authenticating, at the external device, themobile device based upon the received authentication signal,authenticating the mobile device based on the received authenticationsignal including sharing the trust relationship established for thesecurity module.
 16. A wireless security module for pairing with amobile device separate from the security module and authenticating themobile device, the wireless security module comprising: means forstoring security information indicating an association between thesecurity module and the mobile device means for providing anauthentication signal to an external device with which the mobile deviceto be used is the authentication signal including information forestablishing a trust relationship between the security module and theexternal device, the authentication signal including further informationindicating the association between the security module and the mobiledevice, in order to allow the mobile device to share the trustrelationship established between the security module and the externaldevice; and means for sending the authentication signal to allow themobile device to be authenticated using a wireless communication path.17. A wireless security module as claimed in claim 16, wherein theauthentication signal includes a unique identifier for identifying themodule uniquely.
 18. A wireless security module as claimed in claim 16,further comprising a proximity tag for identifying the proximity of themodule relative to a terminal.
 19. A wireless security module as claimedin claim 18, wherein the proximity tag comprises an RFID tag.
 20. Awireless security module as claimed in claim 16, further comprising asecure memory for storing at least one identifier for identifying themobile device.
 21. A wireless security module as claimed in claim 16,further comprising an encryptor for encrypting messages for sending tothe mobile device or terminal.
 22. A wireless security module as claimedin claim 21, wherein a key for use in an asymmetric encryption method isstored in the secure memory.
 23. A wireless security module as claimedin claim 16, further comprising means for communicating with the mobiledevice.
 24. A wireless security module as claimed in claim 16, whereinthe module comprises a data storage device that can be accessedwirelessly.
 25. A wireless security module as claimed in claim 16,further comprising means for sending the authentication signal to aself-service terminal.
 26. A self-service terminal comprising: means forreceiving from a wireless security module an authentication signal forauthenticating a mobile device separate from the security module; andmeans for determining whether the mobile device is authorized to accessservices based upon the authentication signal, the means for determiningwhether the mobile device is authorized to access services beingoperative to determine whether the authentication signal includesinformation authorizing the establishment of a trust relationshipbetween the security module and the self-service terminal, the means fordetermining whether the mobile device is authorized to access servicesbeing further operative to determine whether the authentication signalincludes information indicating an association between the securitymodule and the mobile device so as to allow the mobile device to shareany trust relationship that may be established for the security module.27. A self-service terminal as claimed in claim 26, further comprisingmeans for providing information and services requested from the mobiledevice, in the event that the mobile device is authenticated.
 28. Aself-service terminal as claimed in claim 26, further comprising meansfor communicating with the mobile device.
 29. A self-service terminal asclaimed in claim 26, further comprising means for communicating with aremotely located control center in order to determine whether the mobiledevice is authorized.
 30. A self-service terminal as claimed in claim29, further comprising means for receiving details of a servicerequested by the mobile device from the control center.
 31. An automatedteller machine (ATM) comprising: means for receiving from a wirelesssecurity module an authentication signal for authenticating a mobiledevice separate from the security module; means for determining whetherthe mobile device is authorized to access services based on theauthentication signal received, the means for determining whether themobile device is authorized to access services being operative todetermine whether the authentication signal includes informationauthorizing the establishment of a trust relationship between thesecurity module and the ATM, the means for determining whether themobile device is authorized to access services being further operativeto determine whether the authentication signal includes informationindicating an association between the security module and the mobiledevice so as to allow the mobile device to share any trust relationshipthat may be established for the security module; and means for providinginformation and services requested from the mobile device, in the eventthat the mobile device is authenticated.
 32. A method of operating anautomated teller machine (ATM), the method comprising: receiving from awireless security module an authentication signal for authenticating amobile device separate from the security module; determining, at theATM, whether the mobile device is authorized to access services based onthe authentication signal received, determining whether the mobiledevice is authorized to access services including determining whetherthe authentication signal includes information authorizing theestablishment of a trust relationship between the security module andthe ATM determining whether the mobile device is authorized to accessservices further including determining whether the authentication signalincludes information indicating an association between the securitymodule and the mobile device so as to allow the mobile device to shareany trust relationship that may be established for the security module;and providing information and services requested from the mobile device,in the event that the mobile device is authenticated.
 33. A method asclaimed in claim 32, further comprising communicating with a remotelylocated control center in order to determine whether the mobile deviceis authorized.
 34. A method as claimed in claim 33, further comprisingreceiving details of one or more services requested by the mobile devicefrom the control center.